6.9
Medium
CVE-2026-18916 Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query
Description
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NSD 3.2 | 3.2.11 → < 4.15.1 | 4.15.1 |
References
- www.nlnetlabs.nl www.nlnetlabs.nl
Timeline
- Published
- Last modified
Other CVEs of NSD
The 13 CVEs of NSD →
CVE-2026-101341
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved…
8.7
High
CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous…
8.7
High
CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the…
8.7
High
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes
8.7
High